savant9 Posted December 1, 2010 Share Posted December 1, 2010 After seeing many unanswered questions, plus a bunch of my own, I wanted to find out a few things about the Garmin Chirp. As we already know the chirp gets locked to the first unit that programs it. Surely there is a debug/test connection somewhere on the device that could be used to override this, given the right programmer. But how to access it? Lets take a look. The chirp is quite well sealed, but there is a sticker under the battery area that is easily removed. Under this sticker we see 11 contacts. Bingo. Now the question is, what are these connected to? There is no real way to know without a more detailed understanding of the hardware inside. As this is a well sealed unit, you cannot open it without destruction of the housing. A few minutes of careful dremel work and it is open. For those that aren't aware of how small these things are I have included a Canadian quarter for size comparison. And for those who are unaware of the size of a Canadian quarter, its the same size as a US quarter. The battery side doesn't reveal too much to us. We see that it is made by Dynastream Innovations. This isn't really surprising as they are the company that created the ANT protocol, and are owned by Garmin. I find the copywrite 2007 interesting. I have speculated before that the chirp is basically the same hardware as the Garmin Footpod. It shares the same housing at any rate. More on this later. The only other things to note about this side are the battery contacts, large ground plane, many traces and vias, but otherwise unpopulated. The two unmasked vias are labeled TXD and RST. Well RST goes directly to Pin #11 and Pin #1 goes to the ground plane. 2 contacts identified, only 9 to go. Lets take a close look at the other side. This side is much more interesting. Too hard from that image to read the markings on the components but they are: The larger black square is the micro controller. It is a Texas Instruments MSP430F2350 datasheet here The smaller black square is the wireless transceiver. It is a Nordic Semiconductor nRF24L01 datasheet here There are also a couple crystals and assorted capacitors and resistors, and the unmasked antenna. Note the unpopulated area in the center of the PCB? More speculation on my part, but I believe that this could be where the accelerometer is located if this were a FootPod. Thats all I have for now, I will continue to follow the traces and read the datasheets to determine the remainder of the pin connections. Later this week I will update with more findings. Quote Link to comment
+Driddy Posted December 1, 2010 Share Posted December 1, 2010 Great work! Thanks for posting this -- and I look forward to more installments. Quote Link to comment
+ATXTracker Posted December 1, 2010 Share Posted December 1, 2010 I look forward to hearing more. Reading through your post I was expecting some revelation about hacking or programming the Chirp. Quick! Hook some devices up to those terminals and tell us what you find. Hopefully, they are not easily hackable, as that would lead to theft. Chirp Plug: iPhone Chirp support is currently #12 on the list. A few more votes could push it into top ten: http://feedback.geocaching.com/forums/7527...e-app?ref=title Quote Link to comment
John E Cache Posted December 1, 2010 Share Posted December 1, 2010 Note the unpopulated area in the center of the PCB? More speculation on my part, but I believe that this could be where the accelerometer is located if this were a FootPod.Cool. The first thing I noticed in your pics was the cut out around that unpopulated area. My guess was vibration reduction for that part. I guessed mic, speaker or accelerometer. So I guess we both guessed accelerometer. Does removing the battery reset the owner id? Quote Link to comment
+ecanderson Posted December 1, 2010 Share Posted December 1, 2010 (edited) The first thing I noticed in your pics was the cut out around that unpopulated area. Could also be for functional or EMI reasons - the idea being to cut the ground plane everywhere except back under the traces that follow it - although I'd have to say, routing the thing out like that looks like a bit of overkill. Keeps recirculating currents from other parts from causing noise on a sensitive part. Edited December 1, 2010 by ecanderson Quote Link to comment
+ecanderson Posted December 1, 2010 Share Posted December 1, 2010 To the OP. It would certainly be interesting to see what happens if that RST line is taken to ground during battery insertion ... wonder if it would still remember whose Garmin it belongs to? Quote Link to comment
John E Cache Posted December 1, 2010 Share Posted December 1, 2010 The first thing I noticed in your pics was the cut out around that unpopulated area. Could also be for functional or EMI reasons - the idea being to cut the ground plane everywhere except back under the traces that follow it - although I'd have to say, routing the thing out like that looks like a bit of overkill. Keeps recirculating currents from other parts from causing noise on a sensitive part. Interesting guesses, more please. How about this? The missing part is a vibration detector tuned to the frequency that little "diving board" vibrates at. The cut out vibrates; the pedometer counts a step. Quote Link to comment
+Cacheoholic Posted December 2, 2010 Share Posted December 2, 2010 If the mounting area of the accelerometer was tuned to the natural resonate frequency of a foot step then you would get multiple (resonance) pulses out of the accelerometer with each foot step. This would be highly undesirable. In the vibration world we try hard to keep away from this condition because resonance exaggerates vibration. Most accelerometers have a fixed output of 100mv/g at a very wide frequency bandwidth. There would be no need to try to make it vibrate at a fixed frequency. Quote Link to comment
+dfx Posted December 2, 2010 Share Posted December 2, 2010 Does removing the battery reset the owner id? no it remembers all details of the programming without power. Quote Link to comment
savant9 Posted December 2, 2010 Author Share Posted December 2, 2010 Here are the pinouts from left to right for the top picture. Almost all pins go directly to the MCU. 1: -3v 2: unknown appears to go to RST through a small component, via comes through under MCU 3: MCU pin 10 (TA1)General-purpose digital I/O pin/Timer_A, compare: Out1 output 4: MCU pin 36 (TMS)Test mode select. TMS is used as an input port for device programming and test. 5: MCU pin 37 (TCK)Test clock. TCK is the clock input port for device programming and test. 6: MCU pin 35 (TDI/TCLK)Test data input or test clock input. The device protection fuse is connected to TDI/TCLK. 7: +3v 8: MCU pin 34 (TDO/TDI)Test data output port. TDO/TDI data output or programming data input terminal 9: MCU pin 14 (CAOUT/TA0/CA4)General-purpose digital I/O pin/Comparator_A output/Timer_A, capture: CCI0B input/Comparator_A input 10: MCU pin 32 (TBOUTH/ACLK)General-purpose digital I/Opin/switch allPWMdigital outputs to high impedance -- Timer_B3:TB0 to TB2/ACLK output 11: MCU pin 38 (RST/NMI)Reset input, nonmaskable interrupt input port. Quote Link to comment
savant9 Posted December 2, 2010 Author Share Posted December 2, 2010 To the OP. It would certainly be interesting to see what happens if that RST line is taken to ground during battery insertion ... wonder if it would still remember whose Garmin it belongs to? This is something I do plan to try, but I want to do a few other tests prior to this. Quote Link to comment
savant9 Posted December 3, 2010 Author Share Posted December 3, 2010 Well, reset clears no data. It appears that pulling the RST pin low during data transfer just pauses the transfer, which then resumes quickly after going open on the RST. Un-exciting video below. Quote Link to comment
+ecanderson Posted December 3, 2010 Share Posted December 3, 2010 Well, reset clears no data. Didn't figure it would, but it's good to know that you can't easily clear one of these things with a simple jumper. No doubt all of the important stuff in NVRAM can't be cleared without appropriate strings from the other end no matter what happens. That's good both from a "robustness" and security standpoint. Quote Link to comment
+arcs Posted December 3, 2010 Share Posted December 3, 2010 So, in summation and just to be clear and all, all this Übergeek falderall jibberjabber convo means that it's, umm, "cool", right? Ü I gots me one too. Might hang it on my xmas tree. Quote Link to comment
+hukilaulau Posted December 3, 2010 Share Posted December 3, 2010 Well, I have no idea what you're talking about, but I thought it was pretty cool anyway! Quote Link to comment
+JJnTJ Posted December 3, 2010 Share Posted December 3, 2010 Do you have any JTAG tools to talk to the Boundary Scan port? Quote Link to comment
+ecanderson Posted December 3, 2010 Share Posted December 3, 2010 Do you have any JTAG tools to talk to the Boundary Scan port? Assume you're talking to the OP. I've got JTAG tools, but have nothing in the way of an application for that manufacturer, much less that chip. Looks like it's time to do some searching to see who's distributing locally. Quote Link to comment
savant9 Posted December 3, 2010 Author Share Posted December 3, 2010 Do you have any JTAG tools to talk to the Boundary Scan port? Assume you're talking to the OP. I've got JTAG tools, but have nothing in the way of an application for that manufacturer, much less that chip. Looks like it's time to do some searching to see who's distributing locally. I do have various JTAG tools and apps. I have a Ti Launchpad which may or may not be able to work with the MCU. I just have to find it, or order another, as they are dirt cheap. Quote Link to comment
+smstext Posted December 4, 2010 Share Posted December 4, 2010 just an idea, but many years ago to knock the lock function off on a sony mars bar phone you covered all the pins with tin foil, this would reset the phone and it was ready to use again minus the lock. would covering all pins do the same on this? Quote Link to comment
Suscrofa Posted December 4, 2010 Share Posted December 4, 2010 just an idea, but many years ago to knock the lock function off on a sony mars bar phone you covered all the pins with tin foil, this would reset the phone and it was ready to use again minus the lock. would covering all pins do the same on this? And what about smashing it with a hammer ? Quote Link to comment
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.